@indigoai-us/hq-cloud 6.12.4 → 6.13.0

package/dist/cli/sync.test.js

@@ -235,6 +235,64 @@ describe("sync", () => {
         expect(result.filesSkipped).toBeGreaterThanOrEqual(1);
         expect(fs.readFileSync(path.join(companyDocs, "handoff.md"), "utf-8")).toBe("local version");
     });
+    it("conflict keep marks the entry localDiverges (journal-honesty: kept copy never matched the recorded remote etag)", async () => {
+        const companyDocs = path.join(tmpDir, "companies", "acme", "docs");
+        fs.mkdirSync(companyDocs, { recursive: true });
+        fs.writeFileSync(path.join(companyDocs, "handoff.md"), "local version");
+        fs.writeFileSync(journalPath, JSON.stringify({
+            version: "1",
+            lastSync: new Date().toISOString(),
+            files: {
+                "docs/handoff.md": {
+                    hash: "old-hash-from-last-sync",
+                    size: 20,
+                    syncedAt: new Date(Date.now() - 3600000).toISOString(),
+                    direction: "down",
+                },
+            },
+        }));
+        const result = await sync({
+            company: "acme",
+            onConflict: "keep",
+            vaultConfig: mockConfig,
+            hqRoot: tmpDir,
+        });
+        expect(result.conflicts).toBe(1);
+        const journal = JSON.parse(fs.readFileSync(journalPath, "utf-8"));
+        // remoteEtag still recorded so the conflict can't re-fire (#137 invariant)…
+        expect(journal.files["docs/handoff.md"].remoteEtag).toBeTruthy();
+        // …but the kept-local copy is flagged divergent so a later currency-gated
+        // delete cannot fire on a journal that lies about local==remote.
+        expect(journal.files["docs/handoff.md"].localDiverges).toBe(true);
+    });
+    it("a genuine download clears a stale localDiverges flag (entry is now truly local==remote)", async () => {
+        const companyDocs = path.join(tmpDir, "companies", "acme", "docs");
+        fs.mkdirSync(companyDocs, { recursive: true });
+        fs.writeFileSync(journalPath, JSON.stringify({
+            version: "2",
+            lastSync: new Date().toISOString(),
+            files: {
+                "docs/handoff.md": {
+                    hash: "old-divergent-hash",
+                    size: 20,
+                    syncedAt: new Date(Date.now() - 3600000).toISOString(),
+                    direction: "down",
+                    remoteEtag: "old-etag",
+                    localDiverges: true,
+                },
+            },
+            pulls: [],
+        }));
+        // Remote advanced to a new etag; local absent → genuine download lands the
+        // remote bytes, so local==remote now and the divergence flag must clear.
+        vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce([
+            { key: "docs/handoff.md", size: 42, lastModified: new Date(), etag: '"new-etag"' },
+        ]);
+        await sync({ company: "acme", vaultConfig: mockConfig, hqRoot: tmpDir });
+        expect(fs.existsSync(path.join(companyDocs, "handoff.md"))).toBe(true);
+        const journal = JSON.parse(fs.readFileSync(journalPath, "utf-8"));
+        expect(journal.files["docs/handoff.md"]?.localDiverges).toBeFalsy();
+    });
     it("emits a conflict event with path + resolution on hash mismatch", async () => {
         const companyDocs = path.join(tmpDir, "companies", "acme", "docs");
         fs.mkdirSync(companyDocs, { recursive: true });
@@ -370,6 +428,48 @@ describe("sync", () => {
             .filter((f) => f.includes(".conflict-"));
         expect(litter).toHaveLength(1);
     });
+    it("cloud-authoritative file is PULL-WINS on conflict: overwrites local, no mirror, no false-stamp", async () => {
+        // company-brief.md is server-regenerated (gardener), so a divergence is not
+        // a real conflict — the cloud copy wins. Even under --on-conflict keep, the
+        // conflict path must short-circuit to a plain overwrite: NO `.conflict-`
+        // mirror (the loop) and NO journal stamp of the remote etag over divergent
+        // local content (Finding B). Contrast the docs/handoff.md test above, which
+        // (correctly) keeps local + mirrors for a client-owned file.
+        const companyRoot = path.join(tmpDir, "companies", "acme");
+        fs.mkdirSync(companyRoot, { recursive: true });
+        fs.writeFileSync(path.join(companyRoot, "company-brief.md"), "local richer brief");
+        vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce([
+            { key: "company-brief.md", size: 17, lastModified: new Date(), etag: '"newbrief"' },
+        ]);
+        // Default downloadFile mock writes "mock file content" — the cloud copy.
+        fs.writeFileSync(journalPath, JSON.stringify({
+            version: "1",
+            lastSync: new Date().toISOString(),
+            files: {
+                "company-brief.md": {
+                    hash: "stale-hash",
+                    size: 18,
+                    syncedAt: new Date(Date.now() - 3600000).toISOString(),
+                    direction: "down",
+                },
+            },
+        }));
+        const result = await sync({
+            company: "acme",
+            onConflict: "keep",
+            vaultConfig: mockConfig,
+            hqRoot: tmpDir,
+        });
+        // Cloud wins: not counted as a conflict; local overwritten with the cloud copy.
+        expect(result.conflicts).toBe(0);
+        expect(result.conflictPaths).toEqual([]);
+        expect(fs.readFileSync(path.join(companyRoot, "company-brief.md"), "utf-8")).toBe("mock file content");
+        // No conflict mirror littered.
+        const litter = fs
+            .readdirSync(companyRoot)
+            .filter((f) => f.includes(".conflict-"));
+        expect(litter).toHaveLength(0);
+    });
     it("pre-primes new-file GET presigns before per-file created-by HEADs (avoids the presign-burst breaker trip)", async () => {
         vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce([
             { key: "alpha.md", size: 10, lastModified: new Date(), etag: '"a1"' },
@@ -693,6 +793,152 @@ describe("sync", () => {
         expect(journal.files[untrackedKey]).toBeUndefined();
         expect(journal.files[trackedKey]).toBeUndefined();
     });
+    it("local journal tombstone suppresses drift-restore: a deleted-but-still-remote key is NOT re-downloaded (no respawn)", async () => {
+        // Repro of the intermittent delete-respawn: the user deleted a clean file,
+        // its delete has not (yet) cleared the S3 object, and the SERVER
+        // FILE_TOMBSTONE fetch is degraded (empty map — the logged failure mode).
+        // The only intent record is the LOCAL journal tombstone (`removedAt`).
+        // The drift-restore path must honor it and NOT re-download the key.
+        const key = "docs/handoff.md";
+        const localPath = path.join(tmpDir, "companies", "acme", key);
+        // Remote still lists the object, etag matching the journal, lastModified
+        // BEFORE the local delete — a stale resurrection of a deleted key, not a
+        // genuine remote re-create.
+        vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce([
+            {
+                key,
+                size: 42,
+                lastModified: new Date(Date.now() - 2 * 86_400_000),
+                etag: '"abc123"',
+            },
+        ]);
+        // Degraded-fetch case: server FILE_TOMBSTONE map is EMPTY.
+        setupFetchMock({ tombstones: [] });
+        // Local file ABSENT (user deleted it). Journal entry is a TOMBSTONE,
+        // recent enough to survive TTL GC.
+        fs.writeFileSync(journalPath, JSON.stringify({
+            version: "2",
+            lastSync: "2026-06-19T00:00:00.000Z",
+            files: {
+                [key]: {
+                    hash: "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef",
+                    size: 42,
+                    syncedAt: "2026-06-19T00:00:00.000Z",
+                    direction: "down",
+                    remoteEtag: "abc123",
+                    removedAt: new Date().toISOString(),
+                    removedReason: "local-delete",
+                },
+            },
+            pulls: [],
+        }));
+        await sync({
+            company: "acme",
+            vaultConfig: mockConfig,
+            hqRoot: tmpDir,
+            onEvent: () => { },
+        });
+        // The intentionally-deleted key must NOT be re-materialised.
+        expect(s3Module.downloadFile).not.toHaveBeenCalledWith(expect.anything(), key, expect.anything());
+        expect(fs.existsSync(localPath)).toBe(false);
+    });
+    it("pull producer: a single clean/current/non-divergent missing file is tombstoned (intentional delete), not drift-restored", async () => {
+        // The user deleted a genuinely-synced file. Its entry is clean (etag matches
+        // the current remote — currency holds), not divergent. The pull leg must
+        // treat the absence as an intentional delete: stamp a persisting
+        // `local-delete` tombstone and SKIP the re-download — not resurrect it.
+        const key = "docs/gone.md";
+        const localPath = path.join(tmpDir, "companies", "acme", key);
+        vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce([
+            { key, size: 42, lastModified: new Date(), etag: '"cur123"' },
+        ]);
+        setupFetchMock({ tombstones: [] });
+        fs.writeFileSync(journalPath, JSON.stringify({
+            version: "2",
+            lastSync: new Date().toISOString(),
+            files: {
+                [key]: {
+                    hash: "h",
+                    size: 42,
+                    syncedAt: new Date().toISOString(),
+                    direction: "down",
+                    remoteEtag: "cur123",
+                },
+            },
+            pulls: [],
+        }));
+        await sync({ company: "acme", vaultConfig: mockConfig, hqRoot: tmpDir });
+        expect(s3Module.downloadFile).not.toHaveBeenCalledWith(expect.anything(), key, expect.anything());
+        expect(fs.existsSync(localPath)).toBe(false);
+        const journal = JSON.parse(fs.readFileSync(journalPath, "utf-8"));
+        expect(journal.files[key]?.removedAt).toBeTruthy();
+        expect(journal.files[key]?.removedReason).toBe("local-delete");
+    });
+    it("pull producer: a BULK disappearance is drift-restored, NOT tombstoned (ridge-incident guard in the pull leg)", async () => {
+        // 12 clean files vanish at once (corrupt mirror / bulk rm / checkout). The
+        // bulk-asymmetry guard refuses to treat this as intent — every file is
+        // healed (re-downloaded), none tombstoned.
+        const keys = Array.from({ length: 12 }, (_, i) => `docs/f${i}.md`);
+        vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce(keys.map((k) => ({ key: k, size: 10, lastModified: new Date(), etag: `"e-${k}"` })));
+        setupFetchMock({ tombstones: [] });
+        const files = {};
+        for (const k of keys) {
+            files[k] = {
+                hash: "h",
+                size: 10,
+                syncedAt: new Date().toISOString(),
+                direction: "down",
+                remoteEtag: `e-${k}`,
+            };
+        }
+        fs.writeFileSync(journalPath, JSON.stringify({
+            version: "2",
+            lastSync: new Date().toISOString(),
+            files,
+            pulls: [],
+        }));
+        await sync({ company: "acme", vaultConfig: mockConfig, hqRoot: tmpDir });
+        // All restored, none tombstoned.
+        expect(s3Module.downloadFile).toHaveBeenCalledTimes(12);
+        const journal = JSON.parse(fs.readFileSync(journalPath, "utf-8"));
+        for (const k of keys) {
+            expect(journal.files[k]?.removedAt).toBeUndefined();
+        }
+    });
+    it("pull producer: a local-delete tombstone persists across pulls (not consumed/removed), so the delete stays propagatable", async () => {
+        // After the intentional-delete tombstone is stamped, a later pull must NOT
+        // drop the entry (the push leg still needs it to propagate the S3 delete).
+        // It stays skipped + preserved until the push propagates or TTL GC.
+        const key = "docs/gone.md";
+        const localPath = path.join(tmpDir, "companies", "acme", key);
+        vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce([
+            { key, size: 42, lastModified: new Date(Date.now() - 2 * 86_400_000), etag: '"cur123"' },
+        ]);
+        setupFetchMock({ tombstones: [] });
+        fs.writeFileSync(journalPath, JSON.stringify({
+            version: "2",
+            lastSync: new Date().toISOString(),
+            files: {
+                [key]: {
+                    hash: "h",
+                    size: 42,
+                    syncedAt: new Date().toISOString(),
+                    direction: "down",
+                    remoteEtag: "cur123",
+                    removedAt: new Date().toISOString(),
+                    removedReason: "local-delete",
+                },
+            },
+            pulls: [],
+        }));
+        await sync({ company: "acme", vaultConfig: mockConfig, hqRoot: tmpDir });
+        expect(s3Module.downloadFile).not.toHaveBeenCalledWith(expect.anything(), key, expect.anything());
+        expect(fs.existsSync(localPath)).toBe(false);
+        const journal = JSON.parse(fs.readFileSync(journalPath, "utf-8"));
+        // Entry PRESERVED as a tombstone, not removed.
+        expect(journal.files[key]?.removedAt).toBeTruthy();
+        expect(journal.files[key]?.removedReason).toBe("local-delete");
+    });
     it("aborts on --on-conflict abort", async () => {
         const companyDocs = path.join(tmpDir, "companies", "acme", "docs");
         fs.mkdirSync(companyDocs, { recursive: true });